Enterprise security applications of partition rule based access control (PRBAC)

As commercial enterprises increase their dependency on electronically managed information and compete in global markets, the misuse or loss of enterprise information can cause significant damage to the economic well-being of an enterprise as well as the nation. This paper draws parallels between military and business enterprise access control needs and examines partition rule-based access control (PRBAC) as a potential technology solution to the needs of both communities. PRBAC is an access control technology that allows a user to have access to information as a function of the sensitivity of the information and individual authorizations, based on a user-defined security policy. A user gains access to information as a result of an access control decision which compares sensitivities conveyed in data security labels to authorizations conveyed in user public-key certificates.